With the Cyber Resilience Act (CRA), the European Union is establishing, for the first time, a clear framework for the cybersecurity of products with digital components. The goal is to make these products more secure throughout their entire lifecycle\u2014from development to operation. <\/p>\n\n
What at first glance appears to be a classic manufacturer-related issue actually has much broader implications in practice. In building automation in particular, the CRA not only affects new products but also changes the way we view existing systems and their future viability. <\/p>\n\n
For system integrators, this means that requirements are shifting\u2014away from purely functional systems toward solutions that are secure and operational in the long term.<\/p>\n\n
The Cyber Resilience Act sets forth mandatory cybersecurity requirements for products that include digital functions. These include, among other things, obligations to provide security updates, a structured approach to addressing vulnerabilities, and clear processes for handling security incidents. <\/p>\n\n
The regulation will be implemented in phases. The initial requirements will take effect in September 2026, while the full requirements will apply starting in December 2027. Although the regulation primarily applies to products newly placed on the market, action is already needed today. <\/p>\n\n
The reason for this lies not so much in the regulation itself as in its impact on existing systems.<\/p>\n\n
Modern building automation is highly networked today. DDC controllers, gateways, visualization systems, and field devices communicate with one another and are often connected to higher-level systems or remote access points. <\/p>\n\n
The problem: Many of these systems were designed and installed at a time when cybersecurity did not yet play a central role.<\/p>\n\n
At the same time, building automation systems have very long lifecycles. Systems that are still running smoothly today were often designed ten or fifteen years ago. This is precisely where the gap between the requirements of that time and today\u2019s expectations arises. <\/p>\n\n
The CRA makes this gap more visible\u2014and more relevant.<\/p>\n\n
From a purely legal standpoint, existing facilities do not automatically have to be retrofitted. Nevertheless, a clear trend is emerging in practice: Pressure on existing facilities is increasing. <\/p>\n\n
This happens gradually. Spare parts become harder to come by, support for older components is phased out, and integrating new systems becomes increasingly complex. At the same time, the requirements of IT departments, customers, and even insurance companies regarding security and traceability are on the rise. <\/p>\n\n
The result: Systems continue to function\u2014but are becoming increasingly complex in terms of operation and maintenance.<\/p>\n\n
You hear this statement a lot. And at first glance, it’s true. <\/p>\n\n
The real problem, however, lies not in current operations, but in the question of how a system will evolve over the next few years.<\/p>\n\n
This is typically a gradual process. Updates become less frequent or stop altogether, knowledge of older systems is lost, and necessary adjustments become increasingly time-consuming. None of this happens suddenly, but taken together, these factors lead to a situation in which systems are still running but are becoming increasingly difficult to manage. <\/p>\n\n
This is precisely where the CRA comes into play indirectly, by placing greater emphasis on topics such as updatability, secure communication, and lifecycle management.<\/p>\n\n
This shifts the central question:
This development is also changing expectations regarding system integrators.<\/p>\n\n
Customers are increasingly seeking guidance. They want to know whether their systems are still future-proof, what risks exist, and what a sensible path forward might look like. <\/p>\n\n
This shifts the role of the integrator. In addition to technical implementation, consulting is becoming increasingly important. The goal is to explain how things fit together, highlight options, and work with the customer to define a long-term strategy. <\/p>\n\n
This is exactly where real added value is created.<\/p>\n\n
One of the most obvious responses to this trend is a controls retrofit\u2014that is, the targeted modernization of DDC controllers and related system components.<\/p>\n\n
This is not about a radical overhaul, but rather a structured approach. Existing systems are analyzed, critical components are identified, and they are gradually replaced or modernized. <\/p>\n\n
The major advantage lies in the ability to plan ahead. Instead of having to react to outages or external pressure, measures can be specifically prepared and implemented. At the same time, maintainability improves, integration becomes easier, and the foundation for future requirements is laid. <\/p>\n\n
If you wait too long, you lose your room to maneuver. Decisions then have to be made under time pressure, which often results in higher costs and limited options. <\/p>\n\n
Taking an early look at your own system landscape, on the other hand, provides clarity. It allows you to set priorities, plan budgets, and structure modernization efforts effectively. <\/p>\n\n
The CRA is not a trigger for immediate action, but rather an opportunity to address the issue in a timely manner.<\/p>\n\n
The first step is usually easier than you might think. A structured assessment quickly shows where you stand. Which DDC controllers are in use? What is the current software version? Are there still regular updates? And how clear is the spare parts strategy, really? <\/p>\n\n
These questions alone often provide valuable insights. Based on this, it is possible to determine whether and to what extent action is needed. <\/p>\n\n
The Cyber Resilience Act is more than just a regulatory requirement. It represents a fundamental shift in how we manage digital systems. <\/p>\n\n
In building automation, this means one thing above all else:
This opens up an opportunity for system integrators to evolve their role\u2014becoming a partner that not only operates systems but also actively shapes their future.<\/p>\n\n
Ultimately, it’s not just about compliance.
<\/p>\n","protected":false},"excerpt":{"rendered":"
With the Cyber Resilience Act (CRA), the European Union is establishing, for the first time, a clear framework for the cybersecurity of products with digital elements.<\/p>\n","protected":false},"author":15,"featured_media":13132,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[592,1],"tags":[],"class_list":["post-13133","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-2","category-uncategorized"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.se-elektronic.com\/en\/wp-json\/wp\/v2\/posts\/13133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.se-elektronic.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.se-elektronic.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.se-elektronic.com\/en\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/www.se-elektronic.com\/en\/wp-json\/wp\/v2\/comments?post=13133"}],"version-history":[{"count":1,"href":"https:\/\/www.se-elektronic.com\/en\/wp-json\/wp\/v2\/posts\/13133\/revisions"}],"predecessor-version":[{"id":13134,"href":"https:\/\/www.se-elektronic.com\/en\/wp-json\/wp\/v2\/posts\/13133\/revisions\/13134"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.se-elektronic.com\/en\/wp-json\/wp\/v2\/media\/13132"}],"wp:attachment":[{"href":"https:\/\/www.se-elektronic.com\/en\/wp-json\/wp\/v2\/media?parent=13133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.se-elektronic.com\/en\/wp-json\/wp\/v2\/categories?post=13133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.se-elektronic.com\/en\/wp-json\/wp\/v2\/tags?post=13133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}